Item — HN Reader

Are people today so devoid of personal responsibility that they are unwilling to admit that their claims of "sophisticated hacking attempts" are nothing more than an excuse for one of their staffers clicking a phishing email?

I get that it is hard to admit responsibility, but this is ridiculous...

4 comments

Phishing isn't always a link to a bank website with poor formatting/grammar, and there's nothing inherently unsophisticated about it. Sure it doesn't involve number theory or anything like that, but researching the hundreds of associates someone like Macron knows and crafting convincing, personalized messages for each of them is a large undertaking and really hard to defend against.

Imagine you get an email that appears at first glance to be from your spouse, it mentions your kids by name, and it also mentions that the spouse ran the numbers on your upcoming refinance and can you check the math in the spreadsheet she just attached. Assuming the attacker did their homework (i.e., names were right, you actually are going through a refinance, etc) there's a good chance even savvy users will open that excel file.

Yeah, I'd open it on my chromebook. And if i see a login screen on the way to open said spreadsheet, i'd immediately start worrying and recheck things.

Good luck.

They don't need luck, you just downloaded the attacker's payload onto your machine! Phishing is more than the old "click my link, enter your password". Often they use malware so all you have to do is download the attachment or click the link.

"chromebook" see above

no default downloading, cannot execute anything downloaded

1. Chromebooks can have vulnerabilities too. A buffer overflow in the parsing code for the spreadsheet viewer and you've got arbitrary code execution.

2. What if you just click on a link? Browser exploits are a thing too

parser is in javascript (google docs), in a sandboxed browser (chrome), in a system whose root partition is read-only, and hash-verified each boot and whose bootloader is in a physically-write-protected SPI chip.

good luck :)

Oh, you're right, no one's ever been able to exploit javascript in chrome ;)

And you don't need to persist anything to disk, just get a key logger going in memory. Or scrape the data from your other processes. Once you get arbitrary code execution on the machine it's game over.

Seriously, I deal with this kind of stuff for a living. No one is immune to these kinds of attacks; not you, not me, not anyone.

> their claims of "sophisticated hacking attempts" are nothing more than an excuse for one of their staffers clicking a phishing email

and you know that how?

They themselves said it was phishing...

Admittance or excuse? Decide.

podesta, DNC

And that is related to Macron how?

It's a perfect recent example of a high ranking staffer in a political party clicking through a phishing email. And the person who was supposed to advise him that it was a phish, actually telling him to enter his credentials. And even admitting to it afterwards in numerous interviews.

I have no idea as to what went on with the specifics of this recent french "hack".

https://wikileaks.org/podesta-emails/emailid/34899

Not quite. The IT aide did say that the email (which was an imitation of a real "You've already been hacked" email template) was legitimate, but did not directly recommend clicking on links in the email.

He recommended visiting a correct URL. He should have said "I'm not sure, but don't click; to be safe, go to this URL instead"

Amusingly, the IT guy uses bit.ly for his surveys, and the phishing link was also a bit.ly link.

> "sophisticated hacking attempts" are nothing more than an excuse for one of their staffers clicking a phishing email?

These phishing attempts are definitely very sophisticated. Have you read the Trend Micro report? https://documents.trendmicro.com/assets/wp/wp-two-years-of-p...

Yes. Phishing is ineffective against most competent Internet users. I used to be against it, but more and more I favour the ideas of a basic internet license being a requirement to use the internet.

A huge percent of the time it's an OSI layer 8 (meat) problem.